Users & roles

The Users & Roles page (sidebar entry Users & Roles) has three tabs — Users, Departments, and Teams. The tab you’re on is reflected in the URL (/users?tab=teams), so you can bookmark or share a link that lands on the right view.

Org structure

CraftBot has a two-level org tree:

Tenant
└── Department    e.g. "Customer Support"
    └── Team      e.g. "Tier 1", "Weekend shift"
        └── Users (members + one designated supervisor per team)

Concrete example from healthcare TPA: Department = “Claims.” Inside that department, teams might be “Inpatient Claims,” “Pharmacy Claims,” “Appeals.” A WhatsApp number can route inbound conversations to the “Inpatient Claims” team specifically. The supervisor of “Inpatient Claims” sees only their team’s queue. SLA breaches on those conversations roll up to the parent “Claims” department’s response-time targets.

Users tab

Provisioning a user

1. Go to Users & Roles (make sure the Users tab is selected) and click + Invite User in the top-right of the list. The invite form opens as a modal popup on top of the Users list.
2. Enter the user’s email, first name, last name, and role, then click Send invite.
3. CraftBot creates the account and generates a one-time invite URL. The URL appears in a banner inside the same modal — there is no email transport, so copy the link and share it with the user yourself (Slack, SMS, whatever channel you use).
4. The user opens the link, sets a permanent password, and is taken to their role’s default landing page.

While the invite URL is showing, the form fields are disabled and the Send invite button is replaced with Done. Click Done (or the × in the modal header) to close the modal and return to the Users list, where the new user now appears.

Roles

A user has exactly one role. To change someone’s role, edit their user record.

Deactivation vs deletion

• Deactivate — disables sign-in but preserves the user record (so historical conversations still attribute correctly).
• Delete — soft-deletes the record. Reactivation is possible by an admin within the retention window; after that, the record is purged.

PDPL right-of-erasure: a contact can request data deletion. The platform supports purge of contact + conversation records via Settings → Data → Purge contact.

Password policy

• Minimum 12 characters.
• Mixed case + number + symbol required.
• Maximum age: 90 days (configurable).
• Last 5 passwords cannot be reused.
• bcrypt cost factor 12.

Brute-force protection

5 failed attempts within 15 minutes lock the account for 15 minutes. Lockouts can be cleared by an admin from the user’s record.

MFA

(Forthcoming) — TOTP-based MFA with recovery codes.

API tokens

Service-to-service integrations use API tokens rather than user credentials:

• Generated under Settings → API Tokens (super_admin).
• Scoped to a role (agent / readonly / etc).
• Revocable individually.
• Always sent as Authorization: Bearer <token>.

Departments tab

Departments are tenant-scoped organizational units. They anchor SLA business-hours math, scope disposition forms and Close-CSAT surveys, and feed the per-department chip pickers on the Business Hours, SLA Rules, Disposition Forms, Close-CSAT, and Analytics surfaces. Until this release, departments could only be created via direct API call — the Departments tab is the in-product way to manage them.

1. Go to Users & Roles and switch to the Departments tab. The tab list shows every department on the tenant with its slug, timezone, and active flag.
2. Click + New department in the top-right. The create form opens as a modal popup on top of the Departments list.
3. Type the department’s Name. The Slug field auto-fills with a kebab-case version of the name (e.g. “Pharmacy Network” becomes pharmacy-network) — you can override it before submitting if you need a different value. The slug is used in URLs and API references; pick something stable.
4. Pick the Timezone (IANA) that anchors business-hours math for SLA rules scoped to this department. Defaults to Asia/Dubai. Daylight savings is handled automatically.
5. Leave Active checked unless you’re seeding a department for later use. Inactive departments stay in history but are hidden from the chip pickers on every Settings surface that scopes by department.
6. Click Create. The new row appears in the Departments list and is immediately available everywhere a department can be picked.

To rename, re-slug, change timezone, or toggle active state later, click Edit on the row — the same modal reopens with the current values populated. The slug remains editable on the Edit modal in case you need to renumber URLs.

Teams tab

The Teams tab is the org-structure routing layer one level below departments. A team belongs to exactly one department, optionally has a supervisor user, and is the routing target that channel configurations (e.g. a WhatsApp number) deliver inbound conversations to. Agents belong to teams; supervisors see queues scoped to the teams they supervise. This tab is the only place to create teams — the channel-config team picker on Settings → Channels → WhatsApp reads from this list.

If you land on the Teams tab before any department exists, a yellow banner blocks the + New team button and tells you to create a department first. Every team has to belong to one.

Creating a team

1. Go to Users & Roles and switch to the Teams tab.
2. Click + New team in the top-right. The create form opens as a modal popup on top of the Teams list.
3. Pick the Department the team belongs to. This selection is locked after the team is created — if you need to move a team between departments later, you’ll have to delete and recreate it.
4. Type the team’s Name (e.g. “Tier 1”, “Inpatient Claims”, “Weekend shift”). Required, up to 120 characters.
5. The Slug field auto-fills with a kebab-case version of the name (e.g. “Inpatient Claims” becomes inpatient-claims). Override it before submitting if you need a different value. Lowercase letters, digits, and hyphens only — no leading or trailing hyphen.
6. Pick a Supervisor from the dropdown, or leave it blank to assign one later. The list shows every active admin, supervisor, and super-admin on the tenant. The chosen user sees this team’s conversations on the supervisor dashboard.
7. Leave Active checked unless you’re seeding a team for later use. Inactive teams stay in history but disappear from channel-routing pickers and team-membership controls.
8. Click Create. The new row appears in the Teams list and is immediately available everywhere a team can be picked.

Editing a team

Click Edit on a team’s row to reopen the modal with the current values populated. The Department field is disabled on edit — every other field (name, slug, supervisor, active flag) is editable. Save changes with Save changes in the footer.

Deleting a team

Click Delete to soft-delete the team. Channel configurations that routed to this team fall through to the tenant default; existing user-team membership rows are preserved in history but the team no longer appears in any picker.